Cybersecurity

5835 readers

161 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Be respectful. Everyone should feel welcome here.
No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
No Ads / Spamming.
No pornography.

Community Rules

Idk, keep it semi-professional?
Nothing illegal. We're all ethical here.
Rules will be added/redefined as necessary.

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities [email protected] [email protected] [email protected] [email protected] [email protected]

Notable mention to [email protected]

founded 2 years ago

MODERATORS

kid

[email protected]

Local Networks Go Global When Domain Names Collide (krebsonsecurity.com)

submitted 3 months ago by [email protected] to c/cybersecurity

13 comments fedilink hide all child comments

The proliferation of new top-level domains (TLDs) has exacerbated a well-known security weakness: Many organizations set up their internal Microsoft authentication systems years ago using domain names in TLDs that didn’t exist at the time. Meaning, they are continuously sending their Windows usernames and passwords to domain names they do not control and which are freely available for anyone to register. Here’s a look at one security researcher’s efforts to map and shrink the size of this insidious problem.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 2 points 3 months ago (2 children)

Is there any hope of return for Kerberos and LDAP?

[–] [email protected] 3 points 3 months ago (1 children)

FreeIPA?

[–] [email protected] 3 points 3 months ago* (last edited 3 months ago)

Been using this in my homelab. Pretty great for Linux machines.

If you need to host for a windows network, samba can provide a Windows Server 2008 level AD DC, as well as print and file servers.

You could always install bare LDAP and Kerberos, but then again you could also try eating a cinderblock.

There are alternatives, but they all have their usecases and compromises in comparison. Most businesses want a cookiecutter one size fits all solution. AD is the closest thing.

[–] taladar 1 points 3 months ago

From what I recall Kerberos didn't work all that well in environments with NAT so it is unlikely to replace modern single sign on systems like OpenID Connect.